How to Stop Phishing Attacks: Email Security and Employee Training

Attackers often send mail that claims to come from your domain. SPF, DKIM and DMARC let receiving servers check that claim. The step that matters is moving DMARC from monitoring (p=none) to enforcement (p=quarantine, then p=reject) once legitimate senders are aligned.

Microsoft explains the setup in Set up DMARC for Microsoft 365. Our email spoofing check shows where your domain stands today. A Mississauga development company we worked with made this move; the case study has the details.

• Turn on anti-phishing impersonation protection for the owner, finance staff and anyone who approves payments, plus your main suppliers' domains.
• Use Safe Links where your licence includes it, so links are checked when clicked, not only when delivered.
• Keep the external sender warning on, so staff can see when a message that looks internal came from outside.
• Block auto-forwarding to outside addresses by default. A new forwarding rule is one of the first things an attacker sets up.

Someone will eventually type a password into a fake login page. Multi-factor authentication is what stops that password from being enough.

Use the Authenticator app with number matching rather than text messages where you can. For administrators, require phishing-resistant methods such as passkeys or FIDO2 keys, because some phishing kits now relay MFA codes in real time.

Block legacy authentication, which cannot do MFA at all, with a Conditional Access policy.

Most phishing that costs money is a payment request: new banking details from a "supplier", or an urgent transfer from the "owner". The habit that stops it is a call-back to a number you already have on file, never one in the email.

Short, regular training works better than one long annual session. Run a simulated phishing test now and then, and make it easy and blame-free to report a suspicious message. Our security awareness training guide covers how to set that up.

If you only have a few hours this week, do these in order. Each one is a setting change, not a purchase, on most Microsoft 365 business plans.

• Check your domain with the email spoofing check and note your DMARC policy.
• Confirm MFA is enforced for every user, including the owner and shared mailboxes that allow sign-in.
• List every Global Administrator. If there are more than a few, remove the extras.
• Search all mailboxes for rules that forward mail outside the company.
• Write the call-back rule for payment changes into your accounts payable process and tell the team.
• Put the incident line, (289) 582-9930, somewhere staff can find it without logging in.

Our step-by-step guide for clicked a phishing link goes further, and Microsoft 365 and Google Workspace forensics covers the cases where you need to know exactly what an attacker read or sent.

1. 01

   Report it straight away

   The person who clicked tells IT or calls the 24/7 incident line at (289) 582-9930. Speed matters more than blame.

2. 02

   Reset and revoke

   Change the password from a clean device and revoke the account's active sessions, so a stolen session token stops working too.

3. 03

   Check the mailbox

   Look for new inbox rules, forwarding and sent items nobody wrote, and warn anyone who may have received mail from the account.

4. 04

   Decide on reporting

   Phishing fraud can be reported to the Canadian Anti-Fraud Centre. If personal information was exposed, your privacy lead decides whether it is reportable under PIPEDA.

We set up and maintain these controls as part of managed security, and review the email settings on a schedule rather than once. If you want a second opinion on your tenant, call (289) 582-9930 or contact us; we are staffed 24/7.